Mary, Ok I see your configs. Can I ask how you have this set up? PIX's, routers etc and how they are connected. My initial concern is that some of your external ip's are private (192.168.1.2) on PIX506.
Try this test first of all to ensure basic connectivity from the command line of each PIX.... >From the PIX515: ping outside 192.168.1.2 And from the PIX506: ping outside 151.99.241.102 Does it work both ways? If not then you are going to have difficulty getting a working tunnel. Regards Paul ""Mary Kvitashvili"" wrote in message news:[EMAIL PROTECTED] > > PIX 515 > > PIX Version 6.3(1) > interface ethernet0 10full > interface ethernet1 10full > nameif ethernet0 outside security0 > nameif ethernet1 inside security100 > enable password 8Ry2YjIyt7RRXU24 encrypted > passwd 2KFQnbNIdI.2KYOU encrypted > hostname HQ-PIX > domain-name xxx.org > fixup protocol ftp 21 > fixup protocol h323 h225 1720 > fixup protocol h323 ras 1718-1719 > fixup protocol http 80 > fixup protocol ils 389 > fixup protocol rsh 514 > fixup protocol rtsp 554 > fixup protocol sip 5060 > fixup protocol sip udp 5060 > fixup protocol skinny 2000 > fixup protocol smtp 25 > fixup protocol sqlnet 1521 > names > access-list 101 permit ip 10.11.41.0 255.255.255.0 10.11.34.0 255.255.255.0 > access-list 101 permit ip host 151.99.241.102 host 192.168.1.2 > access-list acl_outbound permit ip any any > access-list 100 permit icmp any any echo-reply > access-list 100 permit icmp any any time-exceeded > access-list 100 permit icmp any any unreachable > pager lines 24 > mtu outside 1500 > mtu inside 1500 > ip address outside 151.99.241.102 255.255.255.0 > ip address inside 10.11.41.1 255.255.255.0 > ip audit info action alarm > ip audit attack action alarm > no failover > failover timeout 0:00:00 > failover poll 15 > no failover ip address outside > no failover ip address inside > pdm history enable > arp timeout 14400 > nat (inside) 0 access-list 101 > nat (inside) 1 10.11.41.0 255.255.255.0 0 0 > nat (inside) 1 0.0.0.0 0.0.0.0 0 0 > access-group 100 in interface outside > access-group acl_outbound in interface inside > conduit permit icmp any any > route outside 0.0.0.0 0.0.0.0 151.99.241.1 1 > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 > timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 > timeout uauth 0:05:00 absolute > aaa-server TACACS+ protocol tacacs+ > aaa-server RADIUS protocol radius > aaa-server LOCAL protocol local > no snmp-server location > no snmp-server contact > snmp-server community public > no snmp-server enable traps > floodguard enable > sysopt connection permit-ipsec > crypto ipsec transform-set hq-tset esp-des esp-md5-hmac > crypto map hq-map 1 ipsec-isakmp > crypto map hq-map 1 match address 101 > crypto map hq-map 1 set peer 192.168.1.2 > crypto map hq-map 1 set transform-set hq-tset > crypto map hq-map interface outside > isakmp enable outside > isakmp key cisco123 address 192.168.1.2 netmask 255.255.255.255 > isakmp identity address > isakmp policy 1 authentication pre-share > isakmp policy 1 encryption des > isakmp policy 1 hash sha > isakmp policy 1 group 2 > isakmp policy 1 lifetime 1000 > telnet timeout 5 > ssh timeout 5 > console timeout 0 > terminal width 80 > Cryptochecksum:9f629d1ea9f9b89090de1e7d3ec467db > > > PIX 506 > > PIX Version 6.3(1) > interface ethernet0 10full > interface ethernet1 10full > nameif ethernet0 outside security0 > nameif ethernet1 inside security100 > enable password 8Ry2YjIyt7RRXU24 encrypted > passwd 2KFQnbNIdI.2KYOU encrypted > hostname Other-PIX > fixup protocol ftp 21 > fixup protocol h323 h225 1720 > fixup protocol h323 ras 1718-1719 > fixup protocol http 80 > fixup protocol ils 389 > fixup protocol rsh 514 > fixup protocol rtsp 554 > fixup protocol sip 5060 > fixup protocol sip udp 5060 > fixup protocol skinny 2000 > fixup protocol smtp 25 > fixup protocol sqlnet 1521 > names > access-list 101 permit ip 10.11.34.0 255.255.255.0 10.11.41.0 255.255.255.0 > access-list 101 permit ip host 192.168.1.2 host 151.99.241.102 > access-list acl_outbound permit ip any any > access-list 100 permit icmp any any echo-reply > access-list 100 permit icmp any any time-exceeded > access-list 100 permit icmp any any unreachable > pager lines 24 > mtu outside 1500 > mtu inside 1500 > ip address outside 192.168.1.2 255.255.255.0 > ip address inside 10.11.34.1 255.255.255.0 > ip audit info action alarm > ip audit attack action alarm > pdm logging informational 100 > pdm history enable > arp timeout 14400 > nat (inside) 0 access-list 101 > nat (inside) 1 10.11.34.0 255.255.255.0 0 0 > nat (inside) 1 0.0.0.0 0.0.0.0 0 0 > access-group 100 in interface outside > access-group acl_outbound in interface inside > conduit permit icmp any any > route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 > timeout xlate 0:05:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 > timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 > timeout uauth 0:05:00 absolute > aaa-server TACACS+ protocol tacacs+ > aaa-server RADIUS protocol radius > aaa-server LOCAL protocol local > aaa-server AuthOutbound protocol tacacs+ > http server enable > no snmp-server location > no snmp-server contact > snmp-server community public > no snmp-server enable traps > floodguard enable > sysopt connection permit-ipsec > sysopt connection permit-pptp > crypto ipsec transform-set co-set esp-des esp-md5-hmac > crypto ipsec security-association lifetime seconds 3600 > crypto map co-map 1 ipsec-isakmp > crypto map co-map 1 match address 101 > crypto map co-map 1 set peer 151.99.241.102 > crypto map co-map 1 set transform-set co-set > crypto map co-map interface outside > isakmp enable outside > isakmp key cisco123 address 151.99.241.102 netmask 255.255.255.255 > isakmp identity address > isakmp policy 1 authentication pre-share > isakmp policy 1 encryption des > isakmp policy 1 hash sha > isakmp policy 1 group 2 > isakmp policy 1 lifetime 1000 > telnet 10.11.209.0 255.255.255.0 inside > telnet 10.11.35.0 255.255.255.0 inside > telnet timeout 15 > ssh 10.11.35.0 255.255.255.0 outside > ssh 151.99.241.0 255.255.255.0 outside > ssh 10.11.35.0 255.255.255.0 inside > ssh 10.11.209.0 255.255.255.0 inside > ssh timeout 60 > management-access inside > console timeout 0 > dhcpd auto_config outside > terminal width 80 > Cryptochecksum:705e2c6ec3ab8e8d641f29e25b1e4c78 Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=69831&t=69684 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
